What are OpenClaw skills? How to install and use them

Install an OpenClaw skill from ClawHub

openclaw skills install pulls a skill from ClawHub, the public registry, into the active workspace's skills/ folder. OpenClaw itself is an open-source assistant that runs on your own computer and answers you in chat apps such as Discord, Slack and Telegram. Before an install, open the skill's ClawHub page. It shows the latest security scan.

A skill in the workspace folder wins a name clash with every other location. With --global, the install lands in ~/.openclaw/skills instead, where every local agent can see it unless an allowlist narrows that.

openclaw skills search "calendar"
openclaw skills install @owner/skill-name
openclaw skills list
openclaw skills update --all

1. Search with openclaw skills search "calendar". Leave the query out to browse ClawHub's Trending feed.
2. Install with openclaw skills install @owner/skill-name. Add --version and a version number to choose a release.
3. Run openclaw skills list to confirm OpenClaw found the skill.
4. If an open chat doesn't offer the skill, send /new to start a fresh session.

Use a skill, and find out why one is missing

You don't have to call a skill by name. OpenClaw puts a short list of eligible skills into the agent's system prompt, each with its name, description and location, and the agent picks one by reading the descriptions.

To call one anyway, open the Control UI with openclaw dashboard, type $ and pick from your skills, as in $release_notes. One message can name up to eight. In chat, a skill named hello-world also runs as /hello-world or /skill hello-world. That slash command exists because user-invocable is true by default. Setting disable-model-invocation: true works the other way: the instructions stay out of the prompt and the model never picks the skill, though an explicit $name still runs it.

Run openclaw skills list --eligible to see what an agent can use, and openclaw skills check to learn why a listed skill isn't ready.

• A metadata.openclaw.requires block hides the skill until every binary in bins is on PATH, every variable in env is set and every path in config is truthy. The anyBins key needs only one binary from its list, and os filters by platform.
• In a sandbox, the binary has to be inside the container as well, since requires.bins is checked on the host only.
• An agent allowlist can hide it. A non-empty agents.entries.*.skills list replaces the defaults instead of adding to them, and an empty one exposes nothing at all.

Write a skill of your own

The sample below turns recent git commits into a draft changelog. Its folder is named changelog-from-git, and so is its name, which must use lowercase letters, digits and hyphens and match the folder. The description is a single line under 160 characters, since it is what the agent reads in its context and what slash-command discovery shows.

Write the description as what the skill does plus the requests that should bring it in, here a changelog, release notes or what changed since the last tag. The metadata line keeps the skill hidden on any machine without git.

---
name: changelog-from-git
description: Drafts a changelog from recent git commits. Use when the user asks for a changelog, release notes or what changed since the last tag.
metadata: { "openclaw": { "requires": { "bins": ["git"] } } }
---

# Changelog from git

1. Run `git describe --tags --abbrev=0` to find the last tag. If there is none, ask which commit to start from.
2. Run `git log TAG..HEAD --oneline`, with that tag in place of TAG, and read the list.
3. Group the commits under Added, Changed and Fixed. Skip merge commits.
4. Write one plain line per change. Never invent an issue number.

1. Create the folder: mkdir -p ~/.openclaw/workspace/skills/changelog-from-git.
2. Save the sample as SKILL.md inside it.
3. Run openclaw skills list. OpenClaw watches SKILL.md files by default, so the skill should appear.
4. Try it from the terminal with openclaw agent --message "write a changelog since the last tag", or name it in a chat with /skill changelog-from-git.

A skill that calls the exec tool needs a prompt that untrusted input can't turn into a shell command. For a file in the skill's own folder, write {baseDir}, as in {baseDir}/scripts/run.sh, not a fixed path.

How OpenClaw skills relate to the Agent Skills format

OpenClaw follows the Agent Skills specification, so a folder with a SKILL.md, a name and a description works in every tool that reads the format. Names follow the same rule in both, up to 64 characters, but descriptions don't. A skill imported from another tool may have one of up to 1,024 characters, so trim it to OpenClaw's one line first. A description written for OpenClaw already fits the specification's limit.

Beyond those two, the specification lists license, compatibility, metadata and an experimental allowed-tools. OpenClaw adds user-invocable, disable-model-invocation, command-dispatch and homepage, none of them in the specification, and stores its gates in metadata, the field the specification leaves to each client. The specification expects strings in that field, though, and OpenClaw reads nested objects.

Publish a skill to ClawHub

Publishing uses a separate CLI, clawhub, which the ClawHub quickstart has you install from npm and sign in to with GitHub. A new skill starts at 1.0.0, and each later change goes out as the next patch version. Add --dry-run to preview the upload. Unchanged content is skipped.

The GitHub account can't be brand-new. Peter Steinberger, OpenClaw's creator, announced that gate on X along with a way for users to report skills.

Write the environment variables, tools and permissions the skill needs into its frontmatter before you publish. ClawHub's security analysis holds those declarations up against what the skill does and flags a mismatch.

npm i -g clawhub
clawhub login
clawhub skill publish ./changelog-from-git

The screenshot is X's own embed of Peter Steinberger's post. Select it to open the post on X.

Read a skill before you install it

Unless you set up sandboxing, tools in the main session run on the host, which means your own machine. Whatever a skill tells the agent to run, it runs there.

ClawHub scans every release, and a skill's audit page shows the outcome: Pass, Review, Warn, Malicious, Pending or Error, with a risk level and the findings. Malicious means don't install. Review is not an accusation. ClawHub's own example is a publishing skill that acts with meaningful authority over an account. And a Pass, the security audits page adds, doesn't replace your own judgment.

Once a skill is installed, openclaw skills verify @owner/skill-name prints ClawHub's trust envelope for it, and --card prints its Skill Card. Installs through skills-sh: carry the label "Not scanned by ClawHub". --force-install lets a GitHub-backed skill in before ClawHub's scan finishes, with no verdict yet. Leave that flag off and install once the scan has one.

Koi Security's audit took every skill on ClawHub at one moment, reported in early February. Antiy CERT counted packages across ClawHub's whole history, all from 12 author IDs. OpenClaw's June dataset covers the latest public skill versions, and its three scanners seldom flagged the same one.

• Read SKILL.md for every command it tells the agent to run through exec, and for what it does with the input.
• Open every file beside it. ClawHub publishes all regular files in a skill folder, so a scripts/ directory can hold much more than instructions.
• Check requires.env and primaryEnv for the secrets and keys the skill asks for.
• Look for an install block. It can fetch dependencies with brew, node, go, uv or a download, and a download entry may carry a sha256 that OpenClaw checks before it installs the file. That field is optional.

On your own machine, security.installPolicy runs a policy command of yours before any install goes ahead. The security FAQ also suggests pinned versions, narrow allowlists and openclaw security audit --deep after a config change. Both screenshots are X's embeds, with the link card under the OpenClaw post left out and its last line shortened by X. Select one to open the post.

Reference: where OpenClaw looks for skills, highest first

A name clash goes to the skill higher in the table. Row 1 is where the creating-skills page builds its first skill, ~/.openclaw/workspace/skills.

Subfolders are fine. OpenClaw finds a SKILL.md up to six folders below a root, so skills/personal/research/SKILL.md loads as research. The grouping is for you alone: the name and the slash command come from the name field, or from the directory name when name is missing.

WORKSPACE is an agent's workspace folder, and STATE_DIR is OpenClaw's state folder, ~/.openclaw unless OPENCLAW_STATE_DIR points elsewhere.

Reference: installing from Git, a local folder or skills.sh

The install command takes other sources too. git:owner/repo@ref clones a Git skill, ./path/to/skill --as my-tool copies a local folder, and skills-sh:owner/repo/slug asks ClawHub to resolve a skills.sh listing to a pinned GitHub commit. Git and local installs need SKILL.md at the source root.

Only ClawHub installs are tracked, in .clawhub/lock.json in the workspace and in .clawhub/origin.json inside each installed skill. Folders named .clawdhub, from before July 2026, are no longer read: rename them to .clawhub before you update or verify an older install.

Frequently asked questions

Sources

1. OpenClaw docs: Skills (read November 3, 2026)https://docs.openclaw.ai/tools/skills
2. OpenClaw docs: Creating skills (read November 3, 2026)https://docs.openclaw.ai/tools/creating-skills
3. OpenClaw docs: Skills config (read November 3, 2026)https://docs.openclaw.ai/tools/skills-config
4. OpenClaw docs: Skills CLI (read November 3, 2026)https://docs.openclaw.ai/cli/skills
5. OpenClaw docs: ClawHub (read November 3, 2026)https://docs.openclaw.ai/clawhub
6. OpenClaw docs: ClawHub quickstart (read November 3, 2026)https://docs.openclaw.ai/clawhub/quickstart
7. OpenClaw docs: ClawHub skill format (read November 3, 2026)https://docs.openclaw.ai/clawhub/skill-format
8. OpenClaw docs: ClawHub security audits (read November 3, 2026)https://docs.openclaw.ai/clawhub/security-audits
9. OpenClaw docs: Security and access control FAQ (read November 3, 2026)https://docs.openclaw.ai/help/faq/security-and-access-control
10. OpenClaw docs: Skills and automation FAQ (read November 3, 2026)https://docs.openclaw.ai/help/faq/skills-and-automation
11. OpenClaw docs: Skill Workshop (read November 3, 2026)https://docs.openclaw.ai/tools/skill-workshop
12. OpenClaw docs: Migrate Claude plugin reference (read November 3, 2026)https://docs.openclaw.ai/plugins/reference/migrate-claude
13. GitHub: openclaw/openclaw README (read November 3, 2026)https://github.com/openclaw/openclaw
14. GitHub: openclaw/clawhub README (read November 3, 2026)https://github.com/openclaw/clawhub
15. ClawHub (read November 3, 2026)https://clawhub.ai
16. Agent Skills specification (read November 3, 2026)https://agentskills.io/specification
17. OpenClaw blog: OpenClaw Collaborates with NVIDIA for Stronger Agent Skill Security (read November 3, 2026)https://openclaw.ai/blog/openclaw-nvidia-skill-security
18. OpenClaw blog: Tencent AIG joins ClawScan (read November 3, 2026)https://openclaw.ai/blog/tencent-aig-joins-clawscan
19. Antiy CERT: ClawHavoc analysis (English edition) (read November 3, 2026)https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/
20. eSecurity Planet: Hundreds of Malicious Skills Found in OpenClaw's ClawHub (read November 3, 2026)https://www.esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub/
21. Peter Steinberger on X: ClawHub reports and the upload gate (read November 3, 2026)https://x.com/steipete/status/2018297794952651111
22. Oren Yomtov on X: 341 malicious skills on ClawHub (read November 3, 2026)https://x.com/orenyomtov/status/2018323558746014087
23. OpenClaw on X: every ClawHub skill now scanned with VirusTotal (read November 3, 2026)https://x.com/openclaw/status/2019865921175577029